I85PREP
⌘ K
NCJOSI study materials
NCJOSI study resources

NCJOSI: Incident Response and Forensics

NCJOSI · Work through your exam, one topic at a time.

All guide sections

Incident Response and Forensics

Incident Response and Forensics tests the lifecycle you follow under pressure and the evidence handling that survives scrutiny. Questions often hinge on sequencing: what you do first, and what you must not destroy.

Core rules

  • NIST SP 800-61 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Lessons learned is not optional paperwork, it drives the next cycle of preparation.
  • Containment has two flavours: short-term (isolate the host, block the C2 domain) and long-term (rebuild, reimage, add compensating controls). Choose based on business impact versus attacker spread.
  • Preserve before you remediate. Follow the order of volatility (RFC 3227): CPU registers and cache, memory, network state and ARP cache, running processes, temp filesystems, disk, remote logs, archival media.
  • Use a write blocker for disk images, hash at acquisition and again at analysis (SHA-256), and record every transfer in a chain-of-custody form with who, what, when, and why.
  • Analyse on a copy, never the original. Keep timestamps in UTC and document timezone offsets on each source.

Worked example

A workstation shows beaconing. Capture order: memory image first with a vetted tool, then netstat-style volatile network state, then the process list, then the disk image through a write blocker. Powering the host down first would clear the encryption keys, injected code, and network connections that explain the beacon, while the disk image would still be available later. Hashing the memory image at capture, storing it read-only, and logging the analyst's initials and the time is what makes the finding defensible.

Traps that cost marks

  • Shutting down or rebooting before memory capture.
  • Scoping too slowly; containment before you know the blast radius can tip off the attacker, but delay can be worse.
  • Attaching original media to an analysis workstation without a write blocker.
  • Treating eradication as complete without verifying persistence mechanisms were removed.